diff --git a/.gitignore b/.gitignore index ff11943..f4e82f2 100644 --- a/.gitignore +++ b/.gitignore @@ -40,3 +40,5 @@ shadow-4.1.4.2.tar.bz2 /shadow-4.17.0.tar.xz.asc /shadow-4.17.4.tar.xz /shadow-4.17.4.tar.xz.asc +/shadow-4.18.0.tar.xz +/shadow-4.18.0.tar.xz.asc diff --git a/shadow-4.17.4-account-tools-setuid.patch b/shadow-4.18.0-account-tools-setuid.patch similarity index 79% rename from shadow-4.17.4-account-tools-setuid.patch rename to shadow-4.18.0-account-tools-setuid.patch index 4c1ff92..9c018f7 100644 --- a/shadow-4.17.4-account-tools-setuid.patch +++ b/shadow-4.18.0-account-tools-setuid.patch @@ -1,8 +1,8 @@ -diff -up shadow-4.15.0/src/chpasswd.c.account-tools-setuid shadow-4.15.0/src/chpasswd.c ---- shadow-4.15.0/src/chpasswd.c.account-tools-setuid 2024-03-08 22:27:04.000000000 +0100 -+++ shadow-4.15.0/src/chpasswd.c 2024-03-11 11:21:57.561150382 +0100 -@@ -443,9 +443,11 @@ int main (int argc, char **argv) - char *cp; +diff -up shadow-4.18.0-rc1/src/chpasswd.c.account-tools-setuid shadow-4.18.0-rc1/src/chpasswd.c +--- shadow-4.18.0-rc1/src/chpasswd.c.account-tools-setuid 2025-06-08 15:58:36.650175673 +0200 ++++ shadow-4.18.0-rc1/src/chpasswd.c 2025-06-09 10:09:17.902939220 +0200 +@@ -448,9 +448,11 @@ int main (int argc, char **argv) + char *newpwd; const char *salt; +#ifdef ACCT_TOOLS_SETUID @@ -13,7 +13,7 @@ diff -up shadow-4.15.0/src/chpasswd.c.account-tools-setuid shadow-4.15.0/src/chp bool errors = false; intmax_t line = 0; -@@ -469,19 +471,23 @@ int main (int argc, char **argv) +@@ -474,19 +476,23 @@ int main (int argc, char **argv) process_root_flag ("-R", argc, argv); prefix = process_prefix_flag ("-P", argc, argv); @@ -77,9 +77,9 @@ diff -up shadow-4.15.0/src/chpasswd.c.account-tools-setuid shadow-4.15.0/src/chp { /* Save the changes */ close_files (); -diff -up shadow-4.15.0/src/groupmems.c.account-tools-setuid shadow-4.15.0/src/groupmems.c ---- shadow-4.15.0/src/groupmems.c.account-tools-setuid 2024-03-08 22:27:04.000000000 +0100 -+++ shadow-4.15.0/src/groupmems.c 2024-03-11 11:16:18.365408572 +0100 +diff -up shadow-4.18.0-rc1/src/groupmems.c.account-tools-setuid shadow-4.18.0-rc1/src/groupmems.c +--- shadow-4.18.0-rc1/src/groupmems.c.account-tools-setuid 2025-06-08 15:58:36.651250652 +0200 ++++ shadow-4.18.0-rc1/src/groupmems.c 2025-06-09 10:08:59.836763261 +0200 @@ -14,9 +14,11 @@ #include #include @@ -92,7 +92,7 @@ diff -up shadow-4.15.0/src/groupmems.c.account-tools-setuid shadow-4.15.0/src/gr #include #include "alloc/x/xmalloc.h" -@@ -430,6 +432,7 @@ static void process_flags (int argc, cha +@@ -417,6 +419,7 @@ static void process_flags (int argc, cha static void check_perms (void) { if (!list) { @@ -100,7 +100,7 @@ diff -up shadow-4.15.0/src/groupmems.c.account-tools-setuid shadow-4.15.0/src/gr #ifdef USE_PAM pam_handle_t *pamh = NULL; int retval; -@@ -463,7 +466,8 @@ static void check_perms (void) +@@ -450,7 +453,8 @@ static void check_perms (void) fail_exit (1); } (void) pam_end (pamh, retval); @@ -110,10 +110,10 @@ diff -up shadow-4.15.0/src/groupmems.c.account-tools-setuid shadow-4.15.0/src/gr } } -diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/newusers.c ---- shadow-4.15.0/src/newusers.c.account-tools-setuid 2024-03-08 22:27:04.000000000 +0100 -+++ shadow-4.15.0/src/newusers.c 2024-03-11 11:20:07.198909046 +0100 -@@ -59,6 +59,7 @@ +diff -up shadow-4.18.0-rc1/src/newusers.c.account-tools-setuid shadow-4.18.0-rc1/src/newusers.c +--- shadow-4.18.0-rc1/src/newusers.c.account-tools-setuid 2025-06-08 15:58:36.652250643 +0200 ++++ shadow-4.18.0-rc1/src/newusers.c 2025-06-09 10:08:59.836928828 +0200 +@@ -67,6 +67,7 @@ static const char Prog[] = "newusers"; static bool rflg = false; /* create a system account */ @@ -121,7 +121,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM static /*@null@*//*@observer@*/char *crypt_method = NULL; #define cflg (NULL != crypt_method) -@@ -75,6 +76,7 @@ static long bcrypt_rounds = 13; +@@ -83,6 +84,7 @@ static long bcrypt_rounds = 13; static long yescrypt_cost = 5; #endif /* USE_YESCRYPT */ #endif /* !USE_PAM */ @@ -129,7 +129,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new static bool is_shadow; #ifdef SHADOWGRP -@@ -97,9 +99,11 @@ NORETURN static void fail_exit (int); +@@ -105,9 +107,11 @@ NORETURN static void fail_exit (int); static int add_group (const char *, const char *, gid_t *, gid_t); static int get_user_id (const char *, uid_t *); static int add_user (const char *, uid_t, gid_t); @@ -141,7 +141,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new static int add_passwd (struct passwd *, const char *); static void process_flags (int argc, char **argv); static void check_flags (void); -@@ -121,6 +125,7 @@ static void usage (int status) +@@ -129,6 +133,7 @@ static void usage (int status) "Options:\n"), Prog); (void) fputs (_(" -b, --badname allow bad names\n"), usageout); @@ -149,7 +149,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM (void) fprintf (usageout, _(" -c, --crypt-method METHOD the crypt method (one of %s)\n"), -@@ -136,9 +141,11 @@ static void usage (int status) +@@ -144,9 +149,11 @@ static void usage (int status) #endif ); #endif /* !USE_PAM */ @@ -161,7 +161,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT) (void) fputs (_(" -s, --sha-rounds number of rounds for the SHA, BCRYPT\n" -@@ -146,6 +153,7 @@ static void usage (int status) +@@ -154,6 +161,7 @@ static void usage (int status) usageout); #endif /* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */ #endif /* !USE_PAM */ @@ -169,7 +169,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new (void) fputs ("\n", usageout); exit (status); -@@ -405,6 +413,7 @@ static int add_user (const char *name, u +@@ -419,6 +427,7 @@ static int add_user (const char *name, u return (pw_update (&pwent) == 0) ? -1 : 0; } @@ -177,7 +177,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM /* * update_passwd - update the password in the passwd entry -@@ -457,6 +466,7 @@ static int update_passwd (struct passwd +@@ -471,6 +480,7 @@ static int update_passwd (struct passwd return 0; } #endif /* !USE_PAM */ @@ -185,7 +185,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new /* * add_passwd - add or update the encrypted password -@@ -465,10 +475,13 @@ static int add_passwd (struct passwd *pw +@@ -479,10 +489,13 @@ static int add_passwd (struct passwd *pw { const struct spwd *sp; struct spwd spent; @@ -199,7 +199,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM void *crypt_arg = NULL; if (NULL != crypt_method) { -@@ -505,13 +518,14 @@ static int add_passwd (struct passwd *pw +@@ -520,13 +533,14 @@ static int add_passwd (struct passwd *pw return update_passwd (pwd, password); } #endif /* USE_PAM */ @@ -215,7 +215,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new if (NULL != sp) { spent = *sp; if ( (NULL != crypt_method) -@@ -547,7 +561,7 @@ static int add_passwd (struct passwd *pw +@@ -563,7 +577,7 @@ static int add_passwd (struct passwd *pw if (!streq(pwd->pw_passwd, "x")) { return update_passwd (pwd, password); } @@ -224,7 +224,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new /* * If there is already a shadow entry, do not touch it. * If there is already a passwd entry with a password, do not -@@ -558,14 +572,14 @@ static int add_passwd (struct passwd *pw +@@ -574,14 +588,14 @@ static int add_passwd (struct passwd *pw || !streq(pwd->pw_passwd, "x")) { return 0; } @@ -241,7 +241,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new if ((crypt_method != NULL) && streq(crypt_method, "NONE")) { spent.sp_pwdp = (char *)password; } else { -@@ -610,35 +624,41 @@ static int add_passwd (struct passwd *pw +@@ -626,35 +640,41 @@ static int add_passwd (struct passwd *pw static void process_flags (int argc, char **argv) { int c; @@ -285,7 +285,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new "bhr", #endif long_options, NULL)) != -1) { -@@ -646,11 +666,13 @@ static void process_flags (int argc, cha +@@ -662,11 +682,13 @@ static void process_flags (int argc, cha case 'b': allow_bad_names = true; break; @@ -299,7 +299,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new case 'h': usage (EXIT_SUCCESS); break; -@@ -659,6 +681,7 @@ static void process_flags (int argc, cha +@@ -675,6 +697,7 @@ static void process_flags (int argc, cha break; case 'R': /* no-op, handled in process_root_flag () */ break; @@ -307,7 +307,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT) case 's': -@@ -698,6 +721,7 @@ static void process_flags (int argc, cha +@@ -714,6 +737,7 @@ static void process_flags (int argc, cha break; #endif /* USE_SHA_CRYPT || USE_BCRYPT || USE_YESCRYPT */ #endif /* !USE_PAM */ @@ -315,7 +315,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new default: usage (EXIT_FAILURE); break; -@@ -730,6 +754,7 @@ static void process_flags (int argc, cha +@@ -746,6 +770,7 @@ static void process_flags (int argc, cha */ static void check_flags (void) { @@ -323,7 +323,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifndef USE_PAM #if defined(USE_SHA_CRYPT) || defined(USE_BCRYPT) || defined(USE_YESCRYPT) if (sflg && !cflg) { -@@ -762,6 +787,7 @@ static void check_flags (void) +@@ -778,6 +803,7 @@ static void check_flags (void) } } #endif /* !USE_PAM */ @@ -331,7 +331,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new } /* -@@ -1052,12 +1078,14 @@ int main (int argc, char **argv) +@@ -1066,12 +1092,14 @@ int main (int argc, char **argv) intmax_t line = 0; uid_t uid; gid_t gid; @@ -346,7 +346,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new log_set_progname(Prog); log_set_logfd(stderr); -@@ -1195,6 +1223,7 @@ int main (int argc, char **argv) +@@ -1191,6 +1219,7 @@ int main (int argc, char **argv) } newpw = *pw; @@ -354,7 +354,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifdef USE_PAM /* keep the list of user/password for later update by PAM */ nusers++; -@@ -1211,6 +1240,7 @@ int main (int argc, char **argv) +@@ -1207,6 +1236,7 @@ int main (int argc, char **argv) usernames[nusers-1] = xstrdup(fields[0]); passwords[nusers-1] = xstrdup(fields[1]); #endif /* USE_PAM */ @@ -362,7 +362,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new if (add_passwd (&newpw, fields[1]) != 0) { fprintf (stderr, _("%s: line %jd: can't update password\n"), -@@ -1327,6 +1357,7 @@ int main (int argc, char **argv) +@@ -1323,6 +1353,7 @@ int main (int argc, char **argv) nscd_flush_cache ("group"); sssd_flush_cache (SSSD_DB_PASSWD | SSSD_DB_GROUP); @@ -370,7 +370,7 @@ diff -up shadow-4.15.0/src/newusers.c.account-tools-setuid shadow-4.15.0/src/new #ifdef USE_PAM /* Now update the passwords using PAM */ for (size_t i = 0; i < nusers; i++) { -@@ -1339,6 +1370,7 @@ int main (int argc, char **argv) +@@ -1334,6 +1365,7 @@ int main (int argc, char **argv) } } #endif /* USE_PAM */ diff --git a/shadow-utils.spec b/shadow-utils.spec index 834ff15..5465e15 100644 --- a/shadow-utils.spec +++ b/shadow-utils.spec @@ -1,12 +1,12 @@ Summary: Utilities for managing accounts and shadow password files Name: shadow-utils -Version: 4.17.4 -Release: 5%{?dist} +Version: 4.18.0 +Release: 1%{?dist} Epoch: 2 License: BSD-3-Clause AND GPL-2.0-or-later URL: https://github.com/shadow-maint/shadow -Source0: https://github.com/shadow-maint/shadow/releases/download/4.17.4/shadow-4.17.4.tar.xz -Source1: https://github.com/shadow-maint/shadow/releases/download/4.17.4/shadow-4.17.4.tar.xz.asc +Source0: https://github.com/shadow-maint/shadow/releases/download/4.18.0/shadow-4.18.0.tar.xz +Source1: https://github.com/shadow-maint/shadow/releases/download/4.18.0/shadow-4.18.0.tar.xz.asc Source2: shadow-utils.useradd Source3: shadow-utils.login.defs Source4: shadow-bsd.txt @@ -23,7 +23,7 @@ Source7: passwd.pamd # Misc manual page changes - non-upstreamable Patch0: shadow-4.15.0-manfix.patch # Probably non-upstreamable -Patch1: shadow-4.17.4-account-tools-setuid.patch +Patch1: shadow-4.18.0-account-tools-setuid.patch ### Dependencies ### Requires: audit-libs >= 1.6.5 @@ -101,7 +101,7 @@ Requires: shadow-utils-subid = %{epoch}:%{version}-%{release} Development files for shadow-utils-subid. %prep -%autosetup -p 1 -S git -n shadow-4.17.4 +%autosetup -p 1 -S git -n shadow-4.18.0 iconv -f ISO88591 -t utf-8 doc/HOWTO > doc/HOWTO.utf8 cp -f doc/HOWTO.utf8 doc/HOWTO @@ -109,9 +109,6 @@ cp -f doc/HOWTO.utf8 doc/HOWTO cp -a %{SOURCE4} %{SOURCE5} . cp -a %{SOURCE6} man/login.defs.d/HOME_MODE.xml -# Force regeneration of getdate.c -rm lib/getdate.c - %build autoreconf %configure \ @@ -272,6 +269,9 @@ rm -f $RPM_BUILD_ROOT/%{_libdir}/libsubid.a %{_libdir}/libsubid.so %changelog +* Tue Jul 22 2025 Iker Pedrosa - 2:4.18.0-1 +- Rebase to version 4.18.0. Resolves: #2374710 + * Fri Jul 18 2025 Iker Pedrosa - 2:4.17.4-5 - Stop assigning subids by default Resolves: CVE-2024-56433 and #2334168 diff --git a/sources b/sources index 6e720c5..8e3da98 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ -SHA512 (shadow-4.17.4.tar.xz) = 06830f654650312a79ccd6d729a51808b324d594abf1c05d56a2d0880936df292ec5c9fd6c7f4ad59a6d0f2bf5be0af42afe6386c24c2c087fd64fff301bade3 -SHA512 (shadow-4.17.4.tar.xz.asc) = 24f14397a975e4b09be087705a96544ff8ad76e0aa8c708ed4a53db3a295ad0a33fd0797fc570dcbb2446d4e103a3e43922a93168f65012eba5d3fe31549ebdd +SHA512 (shadow-4.18.0.tar.xz) = e724670362949ccb570bb300322eb280c28ad609d631072b8db15a5e6eeba9fb9ac5d3df1df270f8b894235e4995b56c0e8f9aadb34d66bb5cea9b7a4f55e6ce +SHA512 (shadow-4.18.0.tar.xz.asc) = bb82b3d54eec0f11ace57609281974b315bba1240eafdae3b6513c7d7dfbcf10c3ae855c74c9eae33539709072046787e4b3e86dfb8bbfbf4bf23446daeb3422